UCRGID-119331

,

Safeguards and Security Requirements for Weapons Plutonium Disposition in Light Water Reactors

L. Lee Thomas R. Scott Strait

October, 1994

This is an informal report intended primarily for intanal or limited external distribution. The opinions and conclurionr &ted ue those of the author and may or may not be tho= of the Laboratory.

Work performed under the auapiccr of the US. Dcputment of Energy by the Lawrence Livermore National Laboratory under Contract W-7405-Eng4.

DISCLAIMER

This documart was prepared as an amount of work sponsored by an agency of the United States Government. Neither the United S t a b Government rux the University of caiifornia nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disdosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commeraal product, process, or service by trade name, trademark, manufacturer, OT otherwise, doesnot Recessanl ' y constitute OT imply its endorsement, recommendation, or favoring by the United States Government or the University of California. The views and qinions of authors expressed herein do not necessarily state or reflect those of the United State Government or the University of California, and shall not be used for advertising or product endorsement pqoses.

"his report has been reproduced directly from the best available copy.

Available to DOE and DOE contractors from the O€ffce of Scientific and Technical Information

P.O. Box 62, Oak Ridge, TN 37831 Prices available from (615) 57&8401, lTS 626-8401

Available to the public from the National TechNcal Information Service

U.S. Department of Commerce 5285 Port Royal Rd.,

Springfield, VA 22161

DISCLAIMER

Portions of this document may be illegible in electronic image products. Images are produced from the best available original document.

Safeguards and Security Requirements for Weapons Plutonium Disposition in Light Water Reactors

L. Lee Thomas R. Scott Strait

Fission Energy and Systems Safety Program Lawrence Livennore National Laboratory

Livermore, CA 9455 1

Abstract

This paper explores the issues surrounding the safeguarding of the plutonium disposition process in support of the United States nuclear weapons dismantlement program. It focuses on the disposition of the plutonium by burning mixed oxide fuel in light water reactors (LWR) and addresses physical protection, material control and accountability, personnel security and international safeguards. The S&S system needs to meet the requirements of the DOE Orders, NRC Regulations and international safeguards agreements. Experience has shown that incorporating S&S measures into early facility designs and integrating them into operations provides S&S that is more effective; more economical, and less intrusive. The plutonium disposition safeguards requirements with which the U.S. has the least experience are the implementation of international safeguards on plutonium metal; the large scale commercialization of the mixed oxide fuel fabrication; and the transportation to and loading in the LWRs of fresh mixed oxide fuel. It is in these areas where the effort needs to be concentrated if the U.S. is to develop safeguards and security systems that are effective and efficient.

1. Introduction

This paper explores the requirements for the safeguarding of the plutonium (Pu) disposition process in support of the United States nuclear weapons dismantlement program. It focuses on the disposition of the Pu by burning mixed oxide fuel in light- water reactors (LM). However, many of the requirements are applicable to other disposition processes. The next section provides a brief introduction to the overall safeguards and security (Sa) system requirements, which include those of the DOE, NRC, and IAEA, and possibly bilateral international agreements. With the general S a requhements as a background, the following three sections of this paper address the

' important issues related to physical protection, material control and accountability, and personnel security. The final section addresses particular international safeguards requirements.

Because of public awareness of potential threats, increased concerns about nuclear proliferation, and the uniqueness of the disposition of weapons grade plutonium, the safeguards and security applied to the disposition of weapons plutonium will be required to meet the highest standards of performance and compliance. A well-planned and executed S&S system should combine physical protection, material contrgl, material accountability, and personnel assurance. These elements of the S&S system need to be integrated With, and take account of, other features of the disposition process. Important features to be considered in designing the S&S system include material form, operations

LPDS427 1

,

activities, and environment, safety, and worker health measures, particularly exposure to ionizing radiation.

Experience has shown that incorporating S&S measures into early facility designs and integrating them into operations provides S&S that is more effective, more ecOnOmiCd, and less intrusive. By considering S&S early in the process design, non-traditional S&S measures, e.g., modified isotopics to reduce material attractiveness, may be exploited. While providing the highest levels of protection and compliance, the S&S system should

minimize impact upon the operations; complement other areas of facility operations, including nuclear safety, process control, quality control, and radiation protection; be integral to the facility design; and minimize S&S costs and maximize reliability by using proven, state-of-the-art technology, instead of labor-intensive methods.

2. General Requirements

The S&S system should meet the requirements of the DOE Orders and NRC Regulations. Either, or bth, agencies may have jurisdiction over parts of the Pu disposition process. In general, DOE and NRC guidelines, although different in format, are very similar in content and early S&S planning does not depend on which is the cognizant agency. A truly effective S&S system should ultimately meet both sets of requirements. DOE and NRC safeguards have the same objective of protecting U.S. special nuclear material (SNM) from theft, diversion, or sabotage by malevolent groups or individuals. IAEA safeguards have the slightly different objective of protecting SNM from diversion by the host nation itself. Accordingly, they may use the same safeguards system with added information authentication and verification reinforced by containment and surveillance measures.

The DOE, NRC and IAEA a l l follow a graded approach to safeguarding special nuclear material. Graded safeguards is the concept of providing the greatest relative amount of control and protection to the types and quantities of special nuiclear material that can be most readily used in a nuclear explosive device or for radiological sabotage. The most detailed graded approach is presented in DOE Order 5633.3A., "Control and Accountability of Nuclear Materials."

In general, as the PU moves through the disposition process from interim storage to its fmal disposition the types and quantities of the material will alllow for a decrease in the level of protection commensurate with the decrease in material attractiveness. However, the decrease is slight until the mixed oxide fuel is irradiated in a reactor. The intermediate storage and the conversion of the Pu metal to Pu oxide will involve DOE Cat I quantities of attractiveness level B (formula quantities of the highest strategic significance). The Pu oxide in bulk form and in fuel assemblies will be Cat I quantities of attractiveness level C, (still formula quantities of the highest strategic significance) until they become highly irradiated (Category IVY attractiveness level E). Irradiated fuel, because of its self-protecting nature, requires the lowest levels of protection.

The types of malevolent acts and the nature of the threats that the S&S system needs to protect against are provided in the DOE and NRC threat guidance. The guidance requires protection against possible malevolent acts that include theft of special nuclear material, radiological and toxicological sabotage, and loss of classified amd sensitive information. These threats from both insiders and outsiders include terrorists, criminals, disgruntled employees, and foreign agents working alone or in collusion. !Site specific threat

LPDS-027 2

characteristics are considered. The most conservative credible threat should be used in designing, implementing, and evaluating S&S systems. The "threat" addressed by IAEA safeguards is clandestine diversion by the host state.

Within the requirements of the DOE and NRC graded approaches, S&S measures will need to be prioritized on a risk-benefithost basis. Vulnerability assessments should be used to evaluate the security risk reduction benefits of competing S&S measures. Adopting the most cost-effective measures will ensure that the S&S systems meets all regulatory requirements and provides the greatest security for the least cost. Safeguards vulnerability assessments should be used as a design evaluation tool to incorporate S&S issues in the Pu disposition process choice, planning and implementation. Vulnerability assessments provide overall measures of the effectiveness of S&S, particularly against abrupt theft and sabotage. Traditional vulnerability assessment techniques concentrate on timely detection, adversary delay, and adversary neutralization. Loss detection sensitivity analysis techniques provide measures of the effectiveness of MC&A against protracted theft and tampering with accountability records. Techniques have also been developed to assess the vulnerabilities of computerized S&S systems. Computer simulation tools are available for performing vulnerability assessments and in-depth evaluations.

3. Physical Protection

The overall design of a physical protection system for a facility handing S N M should include protection-in-depth (several layers of protection measures providing detection, delay, and response); balanced protection (nearly equal detection and delay on all possible adversary paths to targets of similar attractiveness); graded protection (detection, delay, and response commensurate with the assets being protected); and reliability (minimal susceptibi3ity to single point failures and low maintenance requirements). The physical protection system should use proven S&S systems and components that have been validated at other facilities or test programs, but that allow for future technology advances. Technology should be used to reduce the costs of protective force personnel. The prokction system and facility operations should provide compartmentalization of the facility to minimize personnel access to potential targets of theft or other malevolent acts.

The requirements for physical security systems in DOE facilities are contained in DOE Order 5632.1C and the associated manual. Commensurate physical security system requirements for NFZC licensed facilities are contained in the Code of Federal Regulations Title 10 Part 73. Design of a facility to meet either of these two sets of regulations would result in substantially identical physical security systems.

A physical security system for a facility handling Category I quantities of SNM would consist of concentric physical barriers restricting the location of the plutonium to a minimum number of authorized processing and storage locations and the flow of personnel and process material to a minimum number of access/egress portals. Access/egress portals would have access control, search, and personnel identificatiodvalidation systems. The plutonium would be located (processed or stored) in vaults or vault-type moms that could be locked and alarmed when not occupied. There are specific requirements for design of barriers, barrier penetrations, intrusion detection, guard forces, and surveillance systems.

The following paragraphs present some of the more relevant considerations. These issues can be addressed in a rather straight-forward manner for the intermediate storage, PU conversion and mixed oxide fuel fabrication processes. Most also apply to the delivery, storage, and loading of mixed oxide fuel assemblies at nuclear reactors. However, additional physical protection accommodations may have to be made if existing

LPDS-027 3

commercial nuclear reactors are employed, particularly for lunirradiated mixed oxide fuel storage. Physical protection of the fuel in the reactors shoulld reflect the relative inaccessibility of the Pu. Many of the following considerations are not relevant for the irradiated fuel, which according to the graded safeguards approach, requires significantly lower levels of protection.

Facilitv Layout All portions of a large plutonium processing facility will require some level of physical security. The more accessible the plutonium is in a specific area, the more stringent are the security requirements. For new or reconfigured facilities, the facility should be laid out to locate only those areas/functions within the secured areas that need to be there and to minimize the areas where plutonium is accessible.

Dertv Protection Area A property protection area is the lowest level of security required for DOE facilities, beyond the minimal protection required for all parts of the facility for protection against damage, destruction or theft by the general public, A property protection area may take the form of a lighted perimeter fence with an interior patrol road and unrestricted view outside of the fence. Vehicles and personnel entering or leaving the facility are directed through clearly defined portals (Le., gates) in the property protection boundary. An access control system is required to limit entry to authorized personnel. Vehicles and hand-carried items exiting the property protection area are subject to search.

The size of the property protection area should be minimizecl. Fences, lights and patrol roads are expensive and access/egress points must be staffed commensurate with the traffic flow. Such items as employee vehicle parking, cafeterias, general office areas, vehicle maintenance facilities, etc., could be located outside the property protection area based on considerations of property value, employee produciivity, use, etc.

Limited A r a A limited area is required to restrict access to classified matter, which may be present in a facility for conversion of weapons Pu components to oxide or nitrate. A limited area requires an access control barrier. Vehicles and personnel me directed through clearly defined portals where validation of personnel identity is perfbrmed and access is limited to appropriately cleared and authorized personnel. Vehicles, personnel and h a n d d e d items exiting a limited area are subject to search. The access control barriers can be fences or building walls. The barriers must be arranged to prohibit unauthorized visual access to classified material. There must be a means to detect unauthorized intrusion such as alarms, random patrols or visual observation. Limiteid areas can be within other security areas (see below) and share barriers, access controls and intrusion detection systems.

Exclusion Area An exclusion area is required when the mere presence pf a person can reve-al classified information, such as may be the case in a facility for hcndling weapons Pn components. For example, an area of the facility where weapons components are being disassembled would require an exclusion area. An exclusion area is very similar to a limited area but with more access control. Exclusion areas are likely to be necessary only for the weapons disassembly and PU conversion facilities.

LPDS-027 4

tected A r a SNM in quantities nominally above 400 grams Pu (Category II quantity), but less than 2000 gm, must be located (stored or used) within a protected area. A protected area is encompassed by physical barriers and is surrounded by intrusion detection and assessment systems to which access is controlled. A typical protected area barrier system would be double chain link fences, roughly 20 feet apart, with outriggers and, perhaps, razor wire. A means to stop an unauthorized vehicle should be incoprated into the fence system such as steel cables or a concrete barrier. An uneven surface between the fences may be desired to prevent rapid movement on foot. Redundant independent intrusion detection systems would be located on the fences or in the isolation zone between the fences, such as a third fence with sensitive vibration sensors and microwave motion detectors. An assessment system is required, such as closed circuit television or visual observation by guards to observe the isolation zone and provide the ability to assess alarms. Entering and exiting personnel, vehicles and hand carried items must be seaxched. This means an identification (badge) system for personnel entering, X-ray or hand inspection of hand-carried items, metal detectors for personnel, and a capability to inspect incoming and outgoing vehicles.

Material Access Area SNM in quantities nominally above 2000 grams Pu (Category I quantity) must be used or stored within a material access area. A material access area is an area defmed by physical barriers and subject to access control. Material access area must be located within a protected area and the barriers must be separate from the protected area barriers. The material access area bmiers are to be constructed to provide delay time to control, impede or deter unauthorized access by force, stealth or deceit. An example of an acceptable material access area barrier is an eight inch thick reinforced concrete wall including floors and ceilings. All penetrations must be secure andor alarmed. Emergency exits must be security-type doors with alarms and exit-only hardware. Pipes, ducts, cable ways, etc. across a material access area barrier must be designed to prevent personnel access or egress and must not provide a way to transfer matefiaf bypassing normal exit portals. Penetration security can be accomplished by placing physical barriers around solid pipes or cables and grills within large ducts and accessways.

The material access barriers must direct the flow of personnel, materials and vehicles h u g h designated portals. Entering and exiting personnel must be identified and validated. A two-person surveillance procedure must be followed when Category I quantities of Pu, or Category II quantities capable of being "rolled-up" to a Category I quantity, are accessible. That is, anyone working with Pu must be accompanied by a second knowledgeable individual. Incoming and outgoing hand-carried items, containers and vehicles must be inspected for concealed materials. Exits must be provided with portal monitors (i.e., sensitive radiation detectors) to detect concealed SNM. Ingress and egress to the material access area should be designed to facilitate IAEA inspections and monitoring. Domestic safeguards and their protection against malevolent individuals may not always complement IAEA safeguards with their emphasis on protection against diversion by the host state. SNM within the material access area when unattended must be protected by an intrusion detection system, such as motion detectors. S W not in use must be stored in a vault or vault-like room.

Monitoring. Assessment. and Response A secure central alarm and communications center and a separate independent backup station are required. Satellite guard stations must be provided at ingresdegress portals and at observation points. A security force must be provided. The security force must be

LPDS-027 5

sufficient in size and expertise to monitor and assess alarms, ,perform access control and monitoring functions, respond to alarms, neutralize attackers, and provide sufficient back- UP-

TransDortation Transportation of all PU metal, oxide, and mixed oxide shipments, except highly irradiated fuel will be by Safe Secure Transport (SST) vehicles. SSTs are large 18-wheel over-the-road transport vehicles operated by the U.S. Govemiment for the movement of large quantities of fissile material. They are escorted, continuously tracked and heavily guarded. The design of the facility must accommodate the arrival, secured loading/unloading and departure of these vehicles. This will irequire an enclosed secured truck port and unloading dock to protect the PU in transport di.uing its loading/unloading, to maintain the integrity of the material access area, and to shield sensitive features of the SST.

4. Material Control and Accountability

Material control and accountability (MC&A) should be designed and implemented to be closely associated with production process control, access corttrol, and criticality safety. The MC8zA measures should monitor all movement, processing, and access to the special nuclear materials. The MC&A system should assure that all nuclear materials, including those designated as hold-up or waste, are accounted for and rxieasured according to the graded safeguards concept. The material accounting system will have an important role in detecting abrupt and protracted diversion or theft of special nuclear materials and should be structured to provide timely information on the amount and location of all nuclear materials using the concept of near-real-time accounting. Near-real-time accounting is accomplished by combining available information to continuously estimate the quantity of accountable material within the process, then comparing this estimate with the continuously running book inventory to detect trends or anomalies, i.e. protracted or abrupt diversions.

The following should be the general goals for the material accounting system: partition the facility into unit process areas where material balances can be determined (material balance areas); automatically determine material balances incorporating several unit process areas to check for consistency and pmvide redundancy; maximize the use of information already available, such as process control data minimize reliance on manual information collection mid processing; and minimize the requirements for process shutdown and clean-up for inventories by providing for sufficiently accurate measurement of all in-process material.

The requirements for MC&A systems in DOE facilities are contained in DOE Order 5633.3A. Commensurate MC&A system requirements for NIz.C licensed facilities are contained in the Code of Federal Regulation Title 10 Part 74. These two sets of regulations read very differently, but an MC&A system designed to meet either or both DOE and NRC regulations would be essentially the same. The primary difference between a DOE and NRC MC&A system would be in the supporting documentation (DOE Security Plan versus NRC License Application). The accounting structure and measurement systems would be identical. IAEA requirements do differ and these differences are addressed in a later section. The cost and opemtional impact of IAEA

LPDS-027 6

-

safeguards &I be reduced by designed MC&A measures that can perform dual international and domestic safeguards roles.

Material controls should provide a detailed trail and history of the material movement through the process. The accountability measurement locations should be coordinated with the process control and monitoring system while maintaining the needed measurement standards and accuracy required for safeguards purposes. Accountability measurefnents will need to be corrected for bias and precision. A quality control computer subsystem should be designed to collect, correlate, and process measurement control data. As appropriate, the facility will need the capability to prepare and cerQfjf calibration and other quality control standards. Assays and weights at appropriate points in the processes would allow a computer system to monitor the material movements and to localize and identify any material losses or abnormal operating conditions.

The following are some of the specific considerations that must be taken into account when designing an accountability system for the intermediate storage, Pu conversion and fuel fabrication processes. These considerations will influence the size, arrangement and cost of the facilities. Material accountability of discrete items, such as mixed oxide fuel rods will, of course, be significantly simpler than that of bulk Pu metal and oxide.

Access Co ntrol Access control is both a physical protection and a material control function. From a material control perspective, entrances to the material access areas and the individual compartments of the facility should allow only authorized personnel to access the nuclear material and classified information. This access control should be accomplished through modern integrated access control systems such as ARGUS and could be supplemented with biometric devices. The use of tags and personnel locator systems to monitor movement and location of personnel and materials may also be appropriate. The access control system should verify compliance with two-person rule safeguards and should pennit only authorized personnel into compartments of the facility. Further access controls may be appropriate within individual work compartments.

p- n Periodic physical inventories of the nuclear materials within a large scale plutonium facility normally occur every two months. A physical inventory consists of placing all accountable material into measurable forms and/or locations then performing measurements to determine the amount of accountable material actually present. To accomplish a physical inventory the process is normally shutdown and the process material is transfendflushed to locations that can be measured. The results of a physical inventory are compared to the book inventory to determine the inventory difference. The inventory difference should not exceed 0.5% of the active inventory (i.e., the material processed during the inventory period) or 2 kilograms. If the inventory difference exceeds the control limits then the process must remain shut down until the inventory difference is resolved. Nuclear materials in interim or prolonged, low maintenance storage will need to be inventoried as required by DOE Order 5633.3A and its latest implementation manual.

A conhat ion measurement is used to confirm the contents of a previously measured unit (item or batch) to provide assurance that the previously measured quantity of accountable material is still there. This is usually a lesser quality measurement than an accountability or verification measurement and is often more qualitative than quantitative. Confirmatory measurements are used during inventories when it is not practical or necessary to repeat the accountability measurements, for example, for items

LPDS-027 7

in storage. Confirmatory measurements are combined with other safeguards measures such as material control and surveillance to assure that no ma.terial has been stolen or diverted.

5- Plutonium metal or oxide is shipped in Department of Transportation (DOT) approved shipping containers. For an incoming shipment of bulk plutonium metal or oxide, upon arrival the shipment will be confirmed by container count, container identity check, gross container weight check, tamper indicating device verification, and comparison with shipping papers. The incoming shipping containers will be off-loaded and placed into a vault where they will remain until the contents are verified by measurement. The contents of the entire shipment must be verified and any shipper/receiver differences resolved before any of the containers from the shipment can be placed into the process. The container check must be completed upon arrival of the shipment. The Verification measurements must be completed within 10 working days of receipt. Verification measufements may be substantially more difficult than confirmation measurements, depending on the form of the material.

Each outgoing container of plutonium must receive an accountability measurement before it is shipped. The plutonium is placed into DOT approved shipping containers. Each shipping container will be affixed with the appropriate DOT required labels and tamper indicating devices then stored in a vault until loaded onto the outgoing transport vehicle. An area designed €or measurements and container loading and unloading must be provided.

A logical facility design would be to incorporate a secured loaiding dock with an adjacent shippinglreceiving vault and measurement room organized to conveniently support the incoming and outgoing flow of accountable material. A separate loading dock should be provided for non-radioactive materials.

Practices for incoming and outgoing mixed oxide fuel assembles will be comparable to that for Pu oxide and metal allowing for differences in packaging and form.

Material Balance Area Strucm All portions of the facility containing accountable nuclear material must be contained within a material balance area (MBA). The material balance areas should follow the logical organization of the process. This facilitates measurements and inventories and minimizes the impact of the MC&A system on process operation.

The MBA structure can be overlaid onto the process flowsheeit after the flowsheet is established but material control and accountability should be iincorporated into the earliest stages of facility design. Failure to do so will result in inefficient facility operations, unnecessary radiation exposure to facility operators or even redesign or reconstruction of the facility. Receivingkhipping areas, analytical laboratories and storage vaults should normally be separate MBA's. Whenever accountable material is transferred across an MBA boundary, either to or from an outside facility or between h4F3A's wiihin a facility, it must be measured. At the boundary of a major process, the incoming and outgoing units containing nuclear material are normally well defined anti characterized, making it easier to accurately measure the accountable material contents. Conversely, within a process there are usually numerous intermediate steps and often internal recycle waste and scrap streams. The intermediate process materials can be difficult to sample or measure and are often physically difficult to reach. Usually ondy a small number of streams enter or leave the process such as the feed stream, the product stream and a small

LPDS-027 8

number of waste, scrap or byproduct streams. Feed, product and waste streams are quite often discrete items or batches that lend themselves to measurement, sampling and material controls.

Equipment Design -

Design of process equipment must accommodate accountability. Vessels must be designed either to be emptied or provided with a means to homogenize, sample and measure the contents. There must be a means of verifying that vessels are emptied. Containers must be designed to be measured either nondestructively or by homogenization, sampling and destructive analysis. Processing equipment for which the accountable material contents cannot be measured must be designed so that it can be reasonably cleaned out to contain only a verifiable low level of radioactive material.

Measurements Measurements of the process material must be made to provide data for the material control and accountability system. Measurement capability must be provided wherever nuclear material crosses a MBA boundary and at locations within the MBA where material will be collected during an inventory. When the chemical processing flowsheet has been selected, the measurement points can be selected and the appropriate . measurement methods identified. This can be an iterative process. Measurements may be performed by either nondestructive assay or by sampling and destructive assay techniques as appropriate. Each measurement method will be selected to accommodate the chemical, physical and radioactive characteristics of the specific process material being measured and the precision and accuracy required. The required precision and accuracy should be determined by a statistical analysis of the process measurement system (see Loss Detection Sensitivity Analysis below).

Facilitv Lavout The layout of the facility must provide for MC&A activities. Space must be provided within reasonable proximity of the process for accountability measurement equipment so that the flow of material to and from the measurement device does not seriously disrupt the flow of material through the process. Space must be provided for location and oEration of the accountability measurement devices with whatever specialized utilities are n&ed(e.g., conditioned power, room temperature control, etc.).

The layout of the building must also accommodate control of the accountable materials. Access and egress portals must be minimized and designed for controIs such as guard stations, personnel identity checks, portal monitors, a l m s , etc. The facility should be compartmented so that necessary process activities can occur but that unauthorized movement of accountable material can be detected.

Vaults Vault storage space must be provided to store accessible quantities of plutonium. The type and size of the vault storage space must support the mission of the facility. Two types of storage should be considered: short term and long term. Short term or working vault storage should be provided convenient to the processing locations where accessible quantities of plutonium can be securely stored when not in use but can be readily available to support process operations. There are stringent requirements associated with plutonium storage vaults such as inventories, surveillance devices, two-person entry control. The more frequent the entry into the vault, the more stringent the MC&A requirements. If containers of accountable material are to remain at the facility for long periods of time then a separate longer term storage vault should be considered. Short

LF'DS-027 9

term or working vaults should be in the same MBA as the process area that they support. Long term storage vaults should be separate MBA's.

Accountabilitv system A MC&A computer system will be required to collect and compile the accountability data generated within the facility. The accountability computer may be a stand alone with backup or may be shared with other activities such as the process control system. Access to the accounting database must be rigorously controlled to prevent unauthorized access to the accountability data so that no one can cover up ii diversion by changing the database.

The accountability computer must receive data from multiple sources such as measurement devices, laboratory analytical devices, process control systems, the nationwide accounting database system NMMSS (Nuclear Materials Management and Safeguards System, see DOE Order 5633.5), and manual input. The system must be able to maintain an up-to-date database that reflects the condition and location of all accountable nuclear material within the facility. It must be able to manipulate the - accountability data to generate the necessary internal and external reports and be able to prepare printed information or perform computer data transfers.

Near-real-time Accountability Near-real-time accountability is a means of utilizing available. information to track the inventory of accountable material within the facility as close IO real time as practid (hence the term "near-real-time"). The near-real-time accounting system is separate from the accountability database but it may reside on the same computer system and will utilize much of the same data. A near-real-time accounting system will utilize any available piece of reliable information that provides an indication of the quantity of nuclear material located throughout the facility. Many of these indicators are not as rigorous as accountability measurements therefore the results of near-real-time accountability are not an absolute measurement of the accountable material inventory. Rather near-real-time accountabiiity provides a relative indicxtion of the material in process but on a much more timely basis, perhaps hourly rather than once every two months when a physicalinventory is performed. Near-real-time accountability will detect long-term trends indicating a slow loss or diversion of nuclear material or a sudden anomaly indicating an abrupt loss or diversion of material. A proven near-real-time accountability system may be used as the basis to argue for perfonning less frequent physical inventories.

Loss Detectio n Sensitivitv Analvsis A loss detection sensitivity analysis is a way of mathematically modeling an accountability system to estimate its ability to detect loss or diversion of accountable material. When the process flowsheet, material flows, material characteristics and measurement points are identified, the measurement frequencies and uncertainties (accuracy and precision) can be estimated. The material flows and measurement uncertainties are modeled using variance propagation techniques. This results in an estimate of the limit of error on the inventory difference (LEJD). The LEID is an estimate of the sensitivity of the accountability system to detect loss or diversion for the specific measurement systems and material flows assumed. If the LEID is unacceptably large, meaning that too much material could be lost before it is detected, a more sensitive system of measurements must be devised, and vise versa.

LPDS-027 10

Maten ‘a1 Control and Su rveillance Material control is a means of keeping the accountable material only in authorized locations. Proper design of process enclosures, equipment and rooms and attention to the layout of the facility will minimize the locations where material is accessible and could be diverted.

Material surveillance is a layer of security to detect unauthorized movement of accountable material. Surveillance systems can take a number of forms. A two-person surveillance system requires that whenever a certain quantity of material in a single area is accessible, two knowledgeable people have to be present to prevent one person acting alone to perpetrate a theft or diversion. A motion detection and alarm system can be used to detect unauthorized entry to facilities. Active sensor switches can be placed on vault storage locations or access ports to provide an indication of material movement. Radiation sensors located in access/egress points can detect unauthorized movement of accountable material. All surveillance systems should be designed to perform dual international and domestic safeguards roles to the extent possible.

5. Personnel Security

The personnel security issues related to facilities involved in a plutonium disposition scheme are not identifiably different from those of current DOE facilities. DOE requires a Q-clearance of individuals handling SNM. Additionally participation in a Personnel Security Assurance Programs (PSAP) is required for individuals that have direct access to Cat I quantities of SNM. NRC requirements are included in 1OCFR73. Compartmentalization of facilities can reduce the applicability of personnel security requirements.

6. InternationaI Safeguards Inspection Requirements

All nuclear facilities in non-weapons states that have acceded to the nuclear non- proliferation treaty (NPT) and nondefense related nuclear facilities in weapons states that have acceded to the NFT are open to international safeguards inspection. Weapons states, such as the United States, declares a nuclear facility to be non-defense related by placing it on the eligible list for IAEA safeguards inspection. All U.S. civilian facilities are on the eligible list. Russia has historically been more guarded than the U.S. in placing facilities on the eligible list. The IAEA decides whether or not it wants to inspect the facility. If the U.S. offers any facility in the nuclear weapons disposition program for IAEA inspection, it likely would be accepted by the IAEA for safeguards inspection. The U.S. Government has announced that U.S. excess fissile material will be placed under international safeguards. Implementation of the US/IAEA current agreement is governed by 1ocFR75. Additional international safeguards beyond those normally ~qu i red by the IAEA may be necessary, for example because of a bilateral agreement with Russia. However, these would be expected to be similar to MEA safeguards.

The IAEA inspection process begins with preparation of a Design Information Questionnaire (DIQ) by the facility operator. The DIQ is a technical s u m a q of the facility design complete with building layout drawings, a process description, material flow diagrams, a projected material balance, operating philosophy and an explanation of the MC&A system. The prepared DIQ is submitted to the IAEA through the State Department. The MEA will request one or more pre-operational inspections before radioactive material is introduced into the facility to verify the facility design. The IAEA may also wish to validate selected instrumentation used to obtain accountability values and/or computer systems used to make accountability material balances. The IAEA may

LPDS-027 11

wish to place surveillance devices, such as closed circuit television cameras, or material control devices, such as tamper indicating devices, at locations throughout the facility.

When the facility has been placed into operation with accountable nuclear material, lAEA inspectors will validate the operators material balance and verify a subset of the inventory through independent measurement, sampling and analyses. This may include verifying all shipments and receipts using sophisticated NDA techniques. The IAEA inspectors will ask for resolution of discrepancies and anomalies until they are satisfied that the plant operators material balance is representative of the nuclear material inventory and operating history of the plant. The IAEA relies heavily on the concept of "transparency" rather than absolute observation and validation of all of the p [ant operator's MC&A information. Transparency involves disclosure of sufficient information by the plant operator about the design, operation, material flows and throughput of the facility so that the M A inspectors have confidence in MC&A information provided to them.

IAEA inspection does not include inspection of the physical security system. The IAEA depends totally on the host country to provide the necessary physical security.

The international safeguards inspection scheme for a facility i s the result of a negotiation process between the host government (i.e., the U.S. Department of State) and the MEA. This negotiation process results in a facility specific attachment to the IAENcounrry safeguards agreement. Inspection schemes for relatively common facilities such as research or power reactors are straight forward because numerous similar facilities have been previously inspected by the IAEA. Development of inspection schemes for fmt-of - a-kind or one-of-a-kind facilities can resuit in significant negotiations deciding what the international inspectors can and cannot see, sample, measure, have access to, etc. Although, this would be the case for a facility that converts weapons Pu to Pu oxide. However, the IAEA has significant experience with the mixed oxide fuel fabrication plants.

Inspection schemes cannot divulge proprietary information to the international inspectors that gives the facility owner/operator a commercial advantage nor can the international inspectors normally have access to classified infomtion. A facility to convert nuclear weapons parts into nuclear reactor fuel would almost certainly contain restricted data. Classified Restricted Data cannot be disclosed to facilitate international safeguards inspection. National Security Information may be disclosed to IAEA inspectors under limited circumstanCes. Facility attachment negotiations can take years to accomplish, especially when dealing with a unique first-of-a-kind facility. However, inspections of Pu disposition facilities may occur on an ad hoc basis, which may give the IAEA privileges that may not be had under an agreed facility attachment.

7. U.S. and International Safeguard Experience

The U.S. and international experience in safeguarding SNM in processes similar to those under consideration for the disposition of Pu in LWR's varies (depending on the specific process involved. The US. has a great deal of experience safeguarding &e assembly and disassembly of nuclear weapons but no nation has experience implementing international safeguards on the disassembly of nuclear weapons. The difficulty is compounded because it must be done without disclosing nuclear weapons diesign and manufacturing information (Le., Restricted Data or Unclassified Controlled Nuclear Information). The U.S. and international safeguards communities have a lot of applicable experience in the processing, conversion, storage and transportation of plutonium from civilian reactors. The domestic safeguarding of weapons Pu during its processing and conversion to Pu

LpDS-027 12

: .

oxide is very similar to U.S. experience at the Rocky Flats Plant, Hanford and the Savannah River Site. The IAEA has experience with international safeguards on reprocessing of spent fuel for Pu recovery. The U.S. has only limited experience safeguarding mixed oxide reactor fuel fabrication, handling, and transportation. In particular, the U.S. lacks experience in the transportation and the loading of the mixed oxide fuel. The safeguards issues are substantially different from those applied to LEU reactor fuel. The international safeguards community has broad experience in these areas. There is extensive experience, both U.S. and international, in safeguarding civilian reactors.

8. Requirements Summary

This paper explores the issues surrounding the safeguarding of weapons Pu during disposition process, particularly by using the Pu in mixed oxide fuel in light-water reactors. The paper discussed issues related to physical protection, material control and accountability, personnel security, and IAEA safeguards. Experience has shown that incorporating safeguards and security measures into early facility designs and integrating them into operations provides S&S that is more effective, more economical, and less intrusive.

The protection provided by the S&S system needs to meet the requirements of &e DOE Orders and NRC Regulations and be complementary with MEA needs. Either, or both, agencies may have jurisdiction over parts of the Pu disposition process. In general, DOE and NRC guidelines are very similar and early S&S planning does not depend on which is the cognizant agency. DOE and NRC safeguards have the objective of protecting W.S. SNM firom theft, diversion, or sabotage by malevolent groups or individuals. IAEA Safeguards have the slightly different, but largely complemenmy, objective of protecting SNM from diversion by the host nation itself. The IAEA depends completely on the host country for physical security of nuclear material. Safeguarding weapons disassembly without releasing sensitive or classified information, mixed oxide fuel fabrication, and mixed oxide fuel handling and transportation are areas where effort needs to be concentrated for the U.S. to develop cost effective and efficient safeguards and security systems.

Acknowledgments

The authors appreciate the helpful reviews and comments of W. Sutcliie, J. Craig, C. Jaeger, and J. Blasy.

LF'DS-027 13

4

Safeguards and Security Requirements for Weapons Plutonium Disposition in Light Water Reactors

L. Thomas, LLNL (10) S. Strait, LLNL (10) J. Blasy, LLNL G. Davis, LLNL G. Suski, LLNL L. Moore, LLNL J. Kass, LLNL J. Craig, DOE R Moya, SNL C. Jaeger, SNL D. Rutherford, LANL B. Todd, DOE/GTN T. Cousins, DOE W. Hensely, DOE R. Neuhold, DOE D. Bunch, MSI Matt Bunn, NAS, CISAC Carl Walter, LLNL G. Holman, LLNL W. Sutcliffe, LLNL W. Ruhter, LLNL

Distribution for: Safeguards and Security Requirements for Weapons Plutonium Disposition

in Light Water Reactors:

Internal:

L. Thomas, LLNL, L-387, (10)

G. Davis, LLNL, L- 19 1 S. Strait, LLNL, L-195 (10)

G. H o l n ~ t ~ , UNL, L-63 1 G. Suski, UNL, L-632 J. B h y , LLNL, L- 195

L. Moore, LLNL, L- 195 J. Kass, LLNL, L-036

W. Ruhter, LLNL, L-23 1 W. Sutcliffe, UNL, L-019

Carl Walter, LLNL, L- 125 Jor-Shan Choi, LLNL, L-634 M. Bronson, LLNL, L-650

L. Gray, LLNL, L-592

External

Robert Neuhold U.S. Department of Energy 19901 Gemantown Rd. Germantown, MD 20874

Howard Canter

U.S. Department of Energy lo00 Independence Avz SW Washington, DC 20585

DP-40 4B-O14/FORS

Andre Cygelman U.S. Department of Energy, DP42 lo00 Independence Ave. SW Washington, DC 20585

John Williams Bureau of Political Military Affairs Office of Nuclear Energy Affairs U.S. Department of State 2201 C Street NW, Room 7828 Washington, DC 20585

Matt Bunn Committee on International Security and Arms Control 2101 Constitution Ave. Washington, DC 20418

Frank von Hippel Princeton University, The Engr. Quadrangle P.O. Box CN5263 Princeton, NJ 08544-5263

Del Bunch Management Strategies Incorporated 6 Montgomery Village, Suite 400 Gaithersburg, MD 20879

C. Jaeger Sandia National Laboratory P.O. Box 5800 Albuquerque, NM 87185

R. Moya Sandia National Laboratory

P.O. Box 5800 Albuquerque, NM 87185

MS-0768

D. Rutherford

Nonproliferation and International Security Los Alamos National Laboratory Los Alamos, NM 87545

NIS-6

B. Stevenson, U.S. Department of Energy EM1O.l lo00 Independence Ave SW Washington, DC 20585